program: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x9e, 0x64, 0x1f, 0x40, 0x1164, 0x2edc, 0x62de, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1}}]}}, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="1c0000001a005f0414f9f40700090400810080ff0000000000000000", 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xdc}}, 0x0) (async) syz_emit_ethernet(0xbe, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @dev, @local}, {0x0, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "f4cb985d33b16266b5efb88aaa87eda081bac8b2f9a49d564054f1c9218f47b3", "cf8743eb4d9e776f94a6a58d36e006ac614f6f7bce9217cbfea31675d4a860cf6003977b1e4dbb16dc31cc76522bf19d", "5043edd2a8cc8c41345f8feb1a7a8e23043b8a465b1ed5bf8bc91307", {"c7193f7edd1efc4742dc481e6f57f901", "948177bcc5dea4029ba4683a6bdcd7a1"}}}}}}}, 0x0) (async) syz_mount_image$romfs(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="002b2476f7228d3015346c0b322c34a216a422addd36e1e877dba54159cb8250767fc246b804b88270aa285be70fbb3c7758069f358435a8327b84a40c50ff9d32ada0447c024853aea232857375048a1849d6a0690c23098645a4809ade44b70ea284b0b54d8d"], 0x0, 0x139, &(0x7f0000000ac0)="$eJzs2j9KO0EUB/D3+yEEcgSrwC4Yi/2vsbAXBCtP4JLsbAZnnbArSFIFL6BYjEewtRPtPMLWnkBvYLWyycSYnU5EBb+fZr7kDS+TFK96Ti6zgBUO0eb06vD5fy6zTi/a6bOAxTS3T0SdOpRVde2S4ei9XlZT17hgPeizm6qDe8ZFEpo9AAAAAAAAAAAAAAAAAAAAAAD+COtFh/ZQyRvGRRJ8qBbjyXEsRJIXi09s0js6xJTcre9HK/26r0T2bH+Hq73zuu6v1O1Fp42hkv+a3+edZiOvGE8cnsVpkiYnYRj1/C3f3w69WS+v2dG+1G+isrobmftE9u1yn+jJN/eJqD0/1ta5ujhrdl/+foQvCC39t/6W9yAgfDI05wcNWpH1WM8Pty/F4BvnhzHRAH7IWwAAAP//Yfo2Cw==") open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) (async, rerun: 64) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) (async, rerun: 64) r5 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x10008005, 0x0, 0x12, 0x12, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204, 0xfffffffffffffffd]}) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101}, @NFT_MSG_NEWSET={0xc8, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_USERDATA={0x74, 0xd, 0x1, 0x0, "a49db0d46a46746e376884ba24fa8aa2ac69b204ea6f588848c9f6cffb3e5bdb0f622836460a622c97d349014858d190ca8420c52ec1a8c9f02e7af6343af48da19eade428f91a344328e5dea8063fca3c6195276163700653b49f3502f9166ac39dd20d6504767a9868560f78a31316"}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @range={{0xa}, @val={0x4}}}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x104}, 0x1, 0x0, 0x0, 0x850}, 0x50) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) getresgid(&(0x7f0000000480)=0x0, &(0x7f00000004c0), &(0x7f0000000640)) (async) stat(&(0x7f0000000680)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) newfstatat(0xffffffffffffff9c, &(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x100) (rerun: 64) setxattr$system_posix_acl(&(0x7f00000001c0)='./sys/file0\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000000800)={{}, {0x1, 0x1}, [{}, {0x2, 0x3}], {0x4, 0x1}, [{0x8, 0x6, r6}, {0x8, 0x0, r7}, {0x8, 0x1, r8}], {}, {0x20, 0x6}}, 0x4c, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async, rerun: 64) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) r9 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a0, 0xc000, 0x8000008, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d00010004000000010004000000000000000000", @ANYRES32=r9, @ANYBLOB='\x00\x00\x00\x00\x00'], 0x50) (async) io_uring_enter(r9, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) ioctl$MON_IOCQ_URB_LEN(r0, 0x9201) [ 101.939348][ T5335] vhci_hcd vhci_hcd.0: remove, state 4 [ 101.942590][ T5335] usb usb7: USB disconnect, device number 1 [ 101.962400][ T5298] Bluetooth: hci0: command tx timeout [ 101.993740][ T5335] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 101.998930][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.001212][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.016667][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.019216][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.021574][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.024057][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.035090][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.037385][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.039728][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.042255][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.044312][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.050797][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.058404][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.062077][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.064584][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.068629][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.071025][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.076566][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.080110][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.082207][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.084246][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.087138][ T130] vhci_hcd vhci_hcd.0: stop threads [ 102.089431][ T130] vhci_hcd vhci_hcd.0: release socket [ 102.091862][ T130] vhci_hcd vhci_hcd.0: disconnect device [ 102.101878][ T5335] vhci_hcd vhci_hcd.0: remove, state 4 [ 102.104322][ T5335] usb usb6: USB disconnect, device number 1 [ 102.160125][ T5335] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 102.163212][ T181] vhci_hcd vhci_hcd.0: stop threads [ 102.165547][ T181] vhci_hcd vhci_hcd.0: release socket [ 102.170930][ T181] vhci_hcd vhci_hcd.0: disconnect device [ 102.177638][ T181] vhci_hcd vhci_hcd.0: stop threads [ 102.187856][ T181] ================================================================== [ 102.191391][ T181] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 102.195194][ T181] Read of size 8 at addr ffff8880340b8780 by task kworker/u4:7/181 [ 102.199068][ T181] [ 102.200466][ T181] CPU: 0 UID: 0 PID: 181 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 102.200481][ T181] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.200489][ T181] Workqueue: usbip_event event_handler [ 102.200507][ T181] Call Trace: [ 102.200513][ T181] [ 102.200518][ T181] dump_stack_lvl+0xe8/0x150 [ 102.200535][ T181] print_address_description+0x55/0x1e0 [ 102.200557][ T181] ? vhci_shutdown_connection+0x1d4/0x650 [ 102.200568][ T181] print_report+0x58/0x70 [ 102.200580][ T181] kasan_report+0x117/0x150 [ 102.200595][ T181] ? vhci_shutdown_connection+0x1d4/0x650 [ 102.200607][ T181] vhci_shutdown_connection+0x1d4/0x650 [ 102.200620][ T181] event_handler+0x2a4/0x4b0 [ 102.200631][ T181] ? process_scheduled_works+0xa20/0x14e0 [ 102.200644][ T181] process_scheduled_works+0xa8e/0x14e0 [ 102.200660][ T181] ? __pfx_process_scheduled_works+0x10/0x10 [ 102.200673][ T181] ? assign_work+0x3cf/0x5d0 [ 102.200684][ T181] worker_thread+0xa47/0xfb0 [ 102.200698][ T181] ? __kthread_parkme+0x71/0x1f0 [ 102.200712][ T181] kthread+0x388/0x470 [ 102.200752][ T181] ? __pfx_worker_thread+0x10/0x10 [ 102.200764][ T181] ? __pfx_kthread+0x10/0x10 [ 102.200777][ T181] ret_from_fork+0x514/0xb70 [ 102.200792][ T181] ? __pfx_ret_from_fork+0x10/0x10 [ 102.200806][ T181] ? __switch_to+0xc89/0x1420 [ 102.200819][ T181] ? __pfx_kthread+0x10/0x10 [ 102.200832][ T181] ret_from_fork_asm+0x1a/0x30 [ 102.200845][ T181] [ 102.200849][ T181] [ 102.265609][ T181] Allocated by task 1: [ 102.267231][ T181] kasan_save_track+0x3e/0x80 [ 102.269098][ T181] __kasan_kmalloc+0x93/0xb0 [ 102.270968][ T181] __kmalloc_noprof+0x375/0x720 [ 102.272975][ T181] __usb_create_hcd+0x67/0x900 [ 102.275079][ T181] vhci_hcd_probe+0x104/0x3e0 [ 102.277198][ T181] platform_probe+0xf9/0x190 [ 102.279341][ T181] really_probe+0x254/0xae0 [ 102.281444][ T181] __driver_probe_device+0x1e8/0x360 [ 102.283833][ T181] driver_probe_device+0x4f/0x240 [ 102.285993][ T181] __device_attach_driver+0x270/0x410 [ 102.288420][ T181] bus_for_each_drv+0x258/0x2f0 [ 102.290555][ T181] __device_attach+0x2c4/0x450 [ 102.292637][ T181] device_initial_probe+0xa1/0xd0 [ 102.294887][ T181] bus_probe_device+0x12a/0x220 [ 102.297037][ T181] device_add+0x7d7/0xb80 [ 102.298944][ T181] platform_device_add+0x4bd/0x860 [ 102.301238][ T181] platform_device_register_full+0x62d/0x710 [ 102.303797][ T181] vhci_hcd_init+0x227/0x360 [ 102.305756][ T181] do_one_initcall+0x250/0x870 [ 102.307749][ T181] do_initcall_level+0x10a/0x1a0 [ 102.309825][ T181] do_initcalls+0x59/0xa0 [ 102.311611][ T181] kernel_init_freeable+0x29d/0x3e0 [ 102.313828][ T181] kernel_init+0x1d/0x1d0 [ 102.315551][ T181] ret_from_fork+0x514/0xb70 [ 102.317443][ T181] ret_from_fork_asm+0x1a/0x30 [ 102.319430][ T181] [ 102.320477][ T181] Freed by task 5335: [ 102.322169][ T181] kasan_save_track+0x3e/0x80 [ 102.324203][ T181] kasan_save_free_info+0x40/0x50 [ 102.326352][ T181] __kasan_slab_free+0x5c/0x80 [ 102.328429][ T181] kfree+0x1c5/0x640 [ 102.330160][ T181] vhci_hcd_remove+0xe4/0x110 [ 102.332163][ T181] device_release_driver_internal+0x48b/0x880 [ 102.334824][ T181] unbind_store+0x1a1/0x1d0 [ 102.336893][ T181] kernfs_fop_write_iter+0x3a4/0x540 [ 102.339230][ T181] vfs_write+0x612/0xba0 [ 102.341080][ T181] ksys_write+0x150/0x270 [ 102.342998][ T181] do_syscall_64+0x174/0x580 [ 102.345100][ T181] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.347642][ T181] [ 102.348688][ T181] Last potentially related work creation: [ 102.351031][ T181] kasan_save_stack+0x3e/0x60 [ 102.353052][ T181] kasan_record_aux_stack+0xbd/0xd0 [ 102.355296][ T181] insert_work+0x3d/0x330 [ 102.357103][ T181] __queue_work+0xcd8/0x10a0 [ 102.358928][ T181] queue_work_on+0x106/0x1d0 [ 102.360827][ T181] unlink1+0x344/0x3e0 [ 102.362584][ T181] usb_hcd_unlink_urb+0xe6/0x1e0 [ 102.364672][ T181] usb_kill_urb+0x10b/0x2f0 [ 102.366640][ T181] hub_quiesce+0x211/0x330 [ 102.368570][ T181] hub_suspend+0x904/0xad0 [ 102.370584][ T181] usb_suspend_both+0x285/0x1040 [ 102.372677][ T181] usb_runtime_suspend+0x58/0x110 [ 102.374846][ T181] __rpm_callback+0x2c7/0x950 [ 102.376837][ T181] rpm_suspend+0x8a0/0x17b0 [ 102.378766][ T181] __pm_runtime_suspend+0x12f/0x1a0 [ 102.380999][ T181] usb_new_device+0xadf/0x1620 [ 102.383028][ T181] register_root_hub+0x250/0x5c0 [ 102.385080][ T181] usb_add_hcd+0xac7/0xf80 [ 102.387027][ T181] vhci_hcd_probe+0x141/0x3e0 [ 102.388995][ T181] platform_probe+0xf9/0x190 [ 102.390906][ T181] really_probe+0x254/0xae0 [ 102.392832][ T181] __driver_probe_device+0x1e8/0x360 [ 102.395523][ T181] driver_probe_device+0x4f/0x240 [ 102.398289][ T181] __device_attach_driver+0x270/0x410 [ 102.400751][ T181] bus_for_each_drv+0x258/0x2f0 [ 102.402760][ T181] __device_attach+0x2c4/0x450 [ 102.404880][ T181] device_initial_probe+0xa1/0xd0 [ 102.407006][ T181] bus_probe_device+0x12a/0x220 [ 102.409096][ T181] device_add+0x7d7/0xb80 [ 102.410888][ T181] platform_device_add+0x4bd/0x860 [ 102.412989][ T181] platform_device_register_full+0x62d/0x710 [ 102.415695][ T181] vhci_hcd_init+0x227/0x360 [ 102.417805][ T181] do_one_initcall+0x250/0x870 [ 102.419801][ T181] do_initcall_level+0x10a/0x1a0 [ 102.422014][ T181] do_initcalls+0x59/0xa0 [ 102.423917][ T181] kernel_init_freeable+0x29d/0x3e0 [ 102.426120][ T181] kernel_init+0x1d/0x1d0 [ 102.427884][ T181] ret_from_fork+0x514/0xb70 [ 102.429901][ T181] ret_from_fork_asm+0x1a/0x30 [ 102.431920][ T181] [ 102.432963][ T181] Second to last potentially related work creation: [ 102.435680][ T181] kasan_save_stack+0x3e/0x60 [ 102.437684][ T181] kasan_record_aux_stack+0xbd/0xd0 [ 102.439866][ T181] insert_work+0x3d/0x330 [ 102.441737][ T181] __queue_work+0xcd8/0x10a0 [ 102.443682][ T181] queue_work_on+0x106/0x1d0 [ 102.445634][ T181] usb_hcd_submit_urb+0xa3b/0x1b60 [ 102.447849][ T181] usb_start_wait_urb+0x13f/0x5b0 [ 102.450021][ T181] usb_control_msg+0x234/0x3e0 [ 102.452002][ T181] hub_ext_port_status+0x114/0x810 [ 102.454168][ T181] hub_activate+0x740/0x1b20 [ 102.456023][ T181] process_scheduled_works+0xa8e/0x14e0 [ 102.458367][ T181] worker_thread+0xa47/0xfb0 [ 102.460356][ T181] kthread+0x388/0x470 [ 102.462112][ T181] ret_from_fork+0x514/0xb70 [ 102.464138][ T181] ret_from_fork_asm+0x1a/0x30 [ 102.466253][ T181] [ 102.467331][ T181] The buggy address belongs to the object at ffff8880340b8000 [ 102.467331][ T181] which belongs to the cache kmalloc-8k of size 8192 [ 102.473159][ T181] The buggy address is located 1920 bytes inside of [ 102.473159][ T181] freed 8192-byte region [ffff8880340b8000, ffff8880340ba000) [ 102.479035][ T181] [ 102.480125][ T181] The buggy address belongs to the physical page: [ 102.482882][ T181] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x340b8 [ 102.486605][ T181] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 102.490175][ T181] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 102.493374][ T181] page_type: f5(slab) [ 102.495028][ T181] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 102.498227][ T181] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 102.501920][ T181] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 102.505372][ T181] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 102.509070][ T181] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 102.512763][ T181] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 102.516423][ T181] page dumped because: kasan: bad access detected [ 102.519195][ T181] page_owner tracks the page as allocated [ 102.521676][ T181] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15991196756, free_ts 15976000214 [ 102.529895][ T181] post_alloc_hook+0x1f9/0x250 [ 102.531830][ T181] get_page_from_freelist+0x21fa/0x2270 [ 102.534094][ T181] __alloc_frozen_pages_noprof+0x18d/0x380 [ 102.536447][ T181] allocate_slab+0x79/0x5e0 [ 102.538346][ T181] refill_objects+0x2d5/0x350 [ 102.540179][ T181] __pcs_replace_empty_main+0x2bf/0x6b0 [ 102.542476][ T181] __kmalloc_noprof+0x485/0x720 [ 102.544565][ T181] acpi_ut_initialize_buffer+0xca/0x170 [ 102.546803][ T181] acpi_rs_create_pci_routing_table+0x1c0/0xd90 [ 102.549373][ T181] acpi_rs_get_prt_method_data+0xdf/0x150 [ 102.551695][ T181] acpi_get_irq_routing_table+0x98/0xe0 [ 102.553953][ T181] acpi_pci_irq_find_prt_entry+0x163/0x1040 [ 102.556507][ T181] acpi_pci_irq_lookup+0x45/0x690 [ 102.558516][ T181] acpi_pci_irq_enable+0x1ee/0x7a0 [ 102.560625][ T181] do_pci_enable_device+0x26f/0x4a0 [ 102.562885][ T181] pci_enable_device_flags+0x5ab/0x700 [ 102.565282][ T181] page last free pid 10 tgid 10 stack trace: [ 102.567883][ T181] free_pages_prepare+0x960/0xa60 [ 102.569611][ T181] __free_contig_range_common+0x174/0x340 [ 102.571781][ T181] free_pages_bulk+0x48/0x120 [ 102.573620][ T181] vfree+0x224/0x4a0 [ 102.575273][ T181] delayed_vfree_work+0x55/0x80 [ 102.577151][ T181] process_scheduled_works+0xa8e/0x14e0 [ 102.579187][ T181] worker_thread+0xa47/0xfb0 [ 102.580829][ T181] kthread+0x388/0x470 [ 102.582398][ T181] ret_from_fork+0x514/0xb70 [ 102.584197][ T181] ret_from_fork_asm+0x1a/0x30 [ 102.586043][ T181] [ 102.586982][ T181] Memory state around the buggy address: [ 102.589281][ T181] ffff8880340b8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.592536][ T181] ffff8880340b8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.595998][ T181] >ffff8880340b8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.599401][ T181] ^ [ 102.601183][ T181] ffff8880340b8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.604302][ T181] ffff8880340b8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 102.607488][ T181] ==================================================================